according to @BraveSampson the site behaves differently depending on whether devtools is open and keeps rotating endpoints so it's hard to report a specific URL. the download file is https://www.virustotal.com/gui/file/f5d21a4090ae24520c0747ebedaaa90ccdd4fb483996527d935af5057727b235/detection ….
-
This Tweet is unavailable.
-
Show this thread
-
Replying to @bcrypt @BraveSampson
FWIW, on same IP address are also hosted sīgnal[.]com teleģram[.]com lędgėr[.]com
1 reply 3 retweets 26 likes -
Replying to @martijn_grooten @bcrypt
Smart to do a reverse-ip lookup. Thank you for sharing!
1 reply 0 retweets 7 likes -
Replying to @BraveSampson @bcrypt
Also, different IP address, but same registrar and hoster: bravē[.]com torbrōwser[.]com ēxodus[.]com screēncast[.]com flīghtsimulator[.]com tēlegram[.]com (Last one isn't live any more, the others are.)
3 replies 6 retweets 23 likes -
Martijn Grooten Retweeted Martijn Grooten
FYI, quick write-uphttps://twitter.com/martijn_grooten/status/1420813740950396930 …
Martijn Grooten added,
Martijn Grooten @martijn_grootenI wrote up a very brief analysis for@silentpush of some homograph domains impersonating Brave, Telegram, Signal and others that — based on circumstantial evidence — may have been serving the Redline infostealing malware https://www.silentpush.com/blog/using-the-silent-push-app-and-api-to-find-punycode-domains …1 reply 0 retweets 0 likes
This isn't RedLine, it's another infostealer called ArechClient. Write-up from Trend: https://www.trendmicro.com/en_us/research/21/b/finding-multi-step-obfuscated-malware.html … It uses RegAsm to load the eventual payload: https://www.virustotal.com/gui/file/059ea6ee0994314502c421d6bab2841593ecaa287538f06a6e2b039fcb95ba6b/detection …
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.